Thanks! it was as simple as adding this, and importantly (for drupal noobs like me), clear the cache in admin > config > site performance. I had caching disabled in these settings but clearing it still made a difference.
–
AaronMar 19 '11 at 10:14

You might even want to add two explicit arguments (invites/auth/%/%) and extend page arguments to array(2,3). Right now, someone could all that URL without a uid, doing that would prevent that. Also, the cache settings in the UI are just for the page cache. Everything else is still cached and the menu system isn't even a cache at all.
–
BerdirMar 19 '11 at 12:04

My reading of the docs is that 'page_arguments' => array(2) means: "pass path component number 2 as the first argument to the page callback, followed by any optional arguments". So you'd get: RANDOMSTRING, RANDOMSTRING, USERID.

Warning: I am not a Drupal expert and the above may be wrong. You can check it easily enough by giving invites_pageAuth another argument, changing the 2 in your page_arguments, etc.